# CVE-2026-48916: Jenkins LDAP Plugin Remote Code Execution via LDAP Referrals

Source: https://junglewise.ai/threats/cve-2026-48916-jenkins-ldap-plugin-remote-code-execution-via-ldap-referrals  
Publisher: Junglewise Threat Intelligence, https://junglewise.ai/threats  
Published: 2026-05-27. Updated: 2026-07-01  
License: CC BY 4.0 with a link back

CVE-2026-48916 · Severity: medium · CVSS 6.6 · Published 2026-05-27

The Jenkins LDAP Plugin, which allows Jenkins to use LDAP directories for user authentication, is vulnerable to a remote code execution flaw. If an attacker can control the LDAP server or intercept network traffic between Jenkins and the server, they can redirect Jenkins to a malicious source. This allows the attacker to run unauthorized code on the Jenkins controller, potentially leading to a full system takeover and access to sensitive build data.

Technologies: [org.jenkins-ci.plugins:ldap (Maven)](https://junglewise.ai/threats/technologies/org-jenkins-ci-plugins-ldap). Vendors: [Jenkins Project](https://junglewise.ai/threats/vendors/jenkins-project), [Maven](https://junglewise.ai/threats/vendors/maven).

## Quick answers

**Is CVE-2026-48916 exploited in the wild?** No. Junglewise Threat Intelligence has no report of CVE-2026-48916 being exploited in the wild.

**How severe is CVE-2026-48916?** Medium severity, with a CVSS score of 6.6, published 27 May 2026.

**Which products and versions are affected?** Jenkins Project LDAP Plugin <= 807.v7d7de30930cf, 807.v7d7de30930cf and earlier; org.jenkins-ci.plugins:ldap (Maven) <= 807.v7d7de30930cf, ECOSYSTEM:introduced=0,fixed=807.809.vd3a.

**Is there a fix for CVE-2026-48916?** Yes. org.jenkins-ci.plugins:ldap (Maven): upgrade to 807.809.vd3a or later. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.

**How is CVE-2026-48916 attacked?** It is attacked over the network, in a software library.

**Am I affected by CVE-2026-48916?** Check whether you run Jenkins Project LDAP Plugin or org.jenkins-ci.plugins:ldap (Maven) at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

## How to fix

- org.jenkins-ci.plugins:ldap (Maven): upgrade to 807.809.vd3a or later

  ```sh
  # set org.jenkins-ci.plugins:ldap to 807.809.vd3a in your pom.xml or build.gradle
  ```


## Technical details

The Jenkins LDAP Plugin (versions 807.v7d7de30930cf and earlier) fails to validate LDAP referrals. An attacker who controls the configured LDAP server or can perform a Machine-in-the-Middle (MitM) attack can provide a referral pointing to a malicious RMI URL. When Jenkins follows this referral, it attempts to deserialize attacker-controlled data. If suitable 'gadget' classes are present on the classpath, this results in Remote Code Execution (RCE) on the Jenkins controller. The vulnerability is tracked as a combination of SSRF (CWE-918) and unsafe deserialization. It has been patched in version 807.809.vd3a_4e5e4ec98 by disabling the following of LDAP referrals.

## Affected products

- Jenkins Project LDAP Plugin <= 807.v7d7de30930cf

## Identifiers

- CVE-2026-48916
- GHSA-fmjp-mw89-c6h6

## Timeline

- 2026-05-27: disclosed
- 2026-05-27: advisory
- 2026-05-27: patched

## References

- [https://www.jenkins.io/security/advisory/2026-05-27/](https://www.jenkins.io/security/advisory/2026-05-27/)

## Related threats

- [Jenkins LDAP Plugin unvalidated deserialization in LDAP referrals](https://junglewise.ai/threats/cve-2026-48917-jenkins-ldap-plugin-unvalidated-deserialization-in-ldap-referrals)
- [Jenkins LDAP Plugin vulnerable to Cross-Site Request Forgery](https://junglewise.ai/threats/cve-2023-32978-jenkins-ldap-plugin-vulnerable-to-cross-site-request-forgery)